<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
    <title>ShellCheck: SC2035 – Use `./*glob*` or `-- *glob*` so names with dashes won't become options.</title>
    <link rel="stylesheet" href="css/bootstrap.min.css" />
  </head>
  <body style="margin-left: auto; margin-right: auto; max-width: 800px">
    <h1>SC2035 – ShellCheck Wiki</h1>
    <a href="https://github.com/koalaman/shellcheck/wiki/SC2035">See this page on GitHub</a>
    <p style="display: none"><a href="index.html">Sitemap</a></p>
    <hr />
    <h2
id="use-glob-or----glob-so-names-with-dashes-wont-become-options">Use
<code>./*glob*</code> or <code>-- *glob*</code> so names with dashes
won't become options.</h2>
<h3 id="problematic-code">Problematic code:</h3>
<pre><code>rm *</code></pre>
<h3 id="correct-code">Correct code:</h3>
<pre><code>rm ./*</code></pre>
<p>or</p>
<pre><code>rm -- *</code></pre>
<h3 id="rationale">Rationale</h3>
<p>Since files and arguments are strings passed the same way, programs
can't properly determine which is which, and rely on dashes to determine
what's what.</p>
<p>A file named <code>-f</code> (<code>touch -- -f</code>) will not be
deleted by the problematic code. It will instead be interpreted as a
command line option, and <code>rm</code> will even report success.</p>
<p>Using <code>./*</code> will instead cause the glob to be expanded
into <code>./-f</code>, which no program will treat as an option.</p>
<p>Similarly, <code>--</code> by convention indicates the end of
options, and nothing after it will be treated like flags (except for
some programs possibly still special casing <code>-</code> as e.g.
stdin).</p>
<p>Note that changing <code>*</code> to <code>./*</code> in GNU Tar
parameters will add <code>./</code> prefix to path names in the created
archive. This may cause subtle problems (eg. to search for a specific
file in archive, the <code>./</code> prefix must be specified as well).
So using <code>-- *</code> is a safer fix for GNU Tar commands.</p>
<p><code>echo</code> and <code>printf</code> does not have issues unless
the glob is the first word in the command. ShellCheck 0.7.2+ does not
warn for these commands.</p>
<p>For more information, see "<a
href="https://dwheeler.com/essays/filenames-in-shell.html">Filenames and
Pathnames in Shell: How to do it Correctly</a>".</p>
    <hr />
    <p style='font-size: 80%'><a href="../index.html">ShellCheck</a> is a static analysis tool for shell scripts. This page is part of its documentation.</p>
  </body>
</html>


